DragonForce Claims AdvancedHEALTH Data Leak, Threatens Daily Releases
Summary
A ransomware.live monitoring post attributes to DragonForce an unverified claim that AdvancedHEALTH data was leaked and threatens daily releases of more patient data unless payment is made.
Key points
- The post identifies AdvancedHEALTH, a U.S. healthcare organization, as the named victim and DragonForce as the claiming actor.
- The group allegedly claims to have leaked 2.3 million lines of patient information and partner, management, payroll, and HR files.
- The claim threatens to release 1,000 additional lines of patient data daily until payment is made or a timer expires.
- The post cites a DragonForce leak-site entry and says fresh leaks are expected daily.
- The monitoring post says the group's claims have not been independently confirmed.
Article Details
- Victim
- AdvancedHEALTH
- Claim Date
- 2026-05-14
- Encryption Status
- Unknown; the source does not report whether data was encrypted.
- Exfiltration Status
- Claimed by DragonForce; unverified by the article publisher.
- Exfiltrated Data
- DragonForce claims the leaked data includes 2,300,000 lines of full patient information, partner agreements, management, payroll, and HR files.
- Ransom Demand
- No amount disclosed; the post says further leaks would continue until payment or timer expiry.
- Leak Status
- DragonForce claims data was leaked and lists a Day 1 link; the article publisher says the claim cannot be confirmed. Further daily leaks are threatened.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//temp[.]sh/aLnBB/ADI-Day1.zip | Link identified in the post as the alleged Day 1 data leak; the leak and the authenticity of its contents are unverified. |